Last Logon Report Isn't Accurate

Hi there,

I have set a scheduled last logon report for every 2 days. When I look into one of them, then i see clients whose last login date is older than 3 months and I wanted to check if those clients are really not logged in for 3 months but its not true. Most of those clients are currently online and customers usually logs in every morning.
Need help about it.

Last logon for who and to what?

What is the source of your data?

Forgive me please but I definitely have no idea about the source of this data. Can you guide me please how can I check its source?

From the BigFix Console, select the Tools menu, and choose “Manage Properties”. Search through the list (you can start typing the property name) and make note of which Analysis the property you are concerned about is coming from.

I’m not familiar with a default “Last Logon” property. There is the “Last Report Time” property. Is that what you are concerned about?

Hey Tim!
I’ve just checked the section you have mentioned above but I havent seen anything belongs to my report.
My report called “Last Logon Report” and it gives me clients’ the latest logins with username-hostname-date as output but it doesnt feel right. Maybe its a custom report which is created by previous sysadmin.
I’m really so much beginner on bigfix. All I want to do is checking last logins into computers. I want to know when is a computer used for last time.

Is this a Windows/AD environment?

If so, I don’t have a good answer, because if you direct a query for a given user to each DC in the domain you’ll get a different answer.
AD doesn’t regard the last logon as an important piece of information, so it doesn’t get replicated with any degree of urgency (unlike information with is an attribute of the user, rather than an effect of the use of that user).

Depends which o/s this is on.
If linux when you check is this something that you see them logged in, or if you type ‘last username’ also see history there?
linux user logins may not be captured if logins aren’t saved on local server just shipped to remote syslog.
AIX has properties you can query the user account.
linux authenticating to AD also could give unexpected results, depending if you want last login anywhere, or on that server.

1 Like

Yes it’s Windows under AD environment. Just like you’ve said every one of 3 DCs gives different result…